CVE-2017-12871: SimpleSAMLphp Incorrect IV generation for encryption
Summary
CVE-2017-12871: SimpleSAMLphp Incorrect IV generation for encryption. Affects simplesamlphp/simplesamlphp versions >= 1.14.0, < 1.14.12. Fixed in 1.14.12. How to fix ↓
Also tracked for
- simplesamlphp · Debian:11
The same CVE-2017-12871 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SimpleSAMLphp is a PHP-based authentication and federation framework that provides support for SAML (Security Assertion Markup Language) and other authentication protocols. It is widely used for implementing Single Sign-On (SSO) solutions in various web applications. The vulnerability identified as CVE-2017-12871 affects SimpleSAMLphp versions 1.14.x through 1.14.11. This vulnerability arises from the incorrect generation of the initialization vector (IV) during encryption, making it easier for context-dependent attackers to bypass the encryption protection mechanism.
Vulnerability Detail
The aesEncrypt method in the Crypto.php file of the SimpleSAMLphp library uses the first 16 bytes of the secret key as the initialization vector (IV) for encryption. This approach weakens the encryption protection, as the IV should be randomly generated and unique for each encryption operation. By leveraging the predictable IV, an attacker with knowledge of the secret key can potentially decrypt the encrypted data. The vulnerability has a CVSS score of 5.9, indicating a moderate severity level. It is important to note that this vulnerability does not directly lead to remote code execution or privilege escalation, but it can compromise the confidentiality of encrypted data.
How To Fix
Minimum fixed version
1.14.12
This is the first release that contains the fix.
composer require simplesamlphp/simplesamlphp:1.14.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, it is strongly advised to apply the recommended fix by updating SimpleSAMLphp to the latest version.
Conclusion
The vulnerability identified as CVE-2017-12871 in SimpleSAMLphp versions 1.14.x through 1.14.11 allows context-dependent attackers to bypass encryption protection by exploiting the predictable initialization vector (IV) generation. To mitigate this vulnerability, it is crucial to update SimpleSAMLphp to version 1.14.12 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for simplesamlphp/simplesamlphp →
FAQ
SimpleSAMLphp is a PHP-based authentication and federation framework used for implementing Single Sign-On (SSO) solutions.
The vulnerability allows context-dependent attackers with knowledge of the secret key to bypass the encryption protection and potentially decrypt the encrypted data.
No, this vulnerability does not directly lead to remote code execution or privilege escalation. Its impact is limited to compromising the confidentiality of encrypted data.
To mitigate the risk, it is recommended to update SimpleSAMLphp to version 1.14.12 or later.
There is no specific workaround mentioned for this vulnerability. Updating to the latest version is the recommended approach.
References
Related vulnerabilities
Recent vulnerabilities recorded for simplesamlphp/simplesamlphp.
